Subnet Routers | Tailscale Explained

Подписаться 12 тыс.

Просмотров 16 тыс.

50% 1

In today’s installment of our Tailscale Explained series, Alex walks you through everything you ever wanted to know about Tailscale subnet routers. He also shows you how to install Tailscale and configure subnet routers on Windows and Linux.
If you’ve been looking for a way to dip your toe into the Tailscale waters, then a subnet router makes this simple. Perhaps you’re about to migrate a large network and want to try us out without installing the Tailscale client on every device, or have an entire AWS VPC to hook up, a subnet router is a really simple, fast and easy way to get started.
Devices behind a subnet router do not count toward your pricing plan’s device limit either. Personal accounts are always free on Tailscale and can include up to 3 users and 100 devices. Get started today at tailscale.com/yt
Links:
* Subnet routers KB article - tailscale.com/kb/1019/subnets
* Enable IP forwarding - tailscale.com/kb/1019/subnets...
* Disable snat - tailscale.com/kb/1214/site-to...
* Auto approvers for routes and exit nodes - tailscale.com/blog/auto-appro...
* ACLs code snippet - github.com/tailscale-dev/vide...
* Tailscale Explained playlist - • Tailscale Explained
• Your Apple TV is a Sub... - Your Apple TV is a Subnet Router for Tailscale now!
===
Chapters:
00:00 - Start
00:38 - What is a Subnet Router?
05:11 - Windows setup
07:42 - Linux Setup
10:35 - AutoApprovers

Наука

Опубликовано:

8 авг 2024

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 45

@guilmm Месяц назад

Tailscale = black magic. Thanks, Alex.

@kurtisbradley5724 Месяц назад

I love how clear and concise you are with all the complicated network variables. Thank you for publishing these wonderful videos!

@ramborambob3081 Месяц назад

Hi Thank you for the clear explanation of subnet routers. I have been battling for a long time to share files or folders over the internet and using your example i managed to get it working. Thanks once again for your video

@ronarmstrong1229 Месяц назад

I use subnet routers to remotely manage a couple synchronized holiday light displays. Works great to be able to access all the lighting controllers that you can’t install Tailscale on!

@mjscpr 19 дней назад

That was an incredibly well explained and overall well done video. Thanks!

@retrogear Месяц назад

Thanks Alex, as always great videos. I’m using TS to bring in a VPS public IP to my self hosted mail server. The mail server is a Synology box that can reside on any connection anywhere as a result - it just needs to be able to get its Tailscale instance connected. The Synology is also setup to use the VPS as an exit node so it appears with the correct IP for sending emails. The VPS is running Debian and simply port forwards the required ports to the Synology. Slick, reliable and fast.

@hornetbad Месяц назад

i feel, it's just a Magic when i use Tailscale all time man :) thank you for this video

@timekeeper3856 Месяц назад

So beautiful, I cant contain my joy

@avri210984 Месяц назад

Awesome video 📹 as always

@uSlackr 29 дней назад

wouldn't it be nice to add tailscale to esp32 devices

@Feerab Месяц назад

Thanks again Alex

@zulh-civo Месяц назад

Really like this Tailscale Explained series. Any plans to create deeper-dive videos around Tailscale Access Control?

@riddlediddleriddle Месяц назад

I love y'all so much!

@thewebart Месяц назад

Thank you Alex 🎉

@JohnMcclaned Месяц назад

Can you please make a video on how to set up tailscale on a openwrt router? Thanks!

@jjdunlap3363 3 дня назад

First thing is thank you for taking the time to make these videos. I'm not trying to be negative here i'm just offering some constructive criticism. You make these videos and explain alot of things but then skip over the other stuff like we're super computer programmers or something. Those kinda people dont need these videos, the people watching your videos are just normal people trying to make something work more than likely, for me its a plex server. For the others who knows but im pretty sure im right. Im technology inclined but i still struggle with the more advanced stuff that you like to not talk about lol. So Ive setup my subnet routers by following along but how are people supposed to connect to my plex server now? What IP address do i use the tailscale one or the one provided by my router 192.168? It would be helpful if you could explain the rest of it like how to connect a printer and how to connect a tv or how to connect whatever really. Youve got to tailor your content more toward your audience (dumb it down a little and slow it down a little more lol). Other than that great videos lol. I hope you dont take this the wrong way lol

@tonyweavers4292 Месяц назад

Thanks Alex.

@jakubduda Месяц назад

Will there be any performance impact using the subnet router method versus a native installation on the devices I am routing this traffic to?

@achan7396 22 дня назад

Hi Alex, thank you for all the details setup for tailscale. Can you please do a video on how to Auto start tailscale when out of range of home wifi and auto turn off tailscale when back in the house wifi? Or is it even possible? I'm using android phone. Thanks in advance!

@flexzuu Месяц назад

Would be really great to get an advanced video about using subnet routers to talk the opposite way too, i got it working at some point by configuring the subnet router as gateway for the ts ip range in my network. also how does tailscale auth play into this topic? can i use the external ip range now in rules? another question how to solve conflicting ip ranges from multiple subnet routers.

@DanTheMan827 20 дней назад

I have multiple devices configured as a subnet router for the same subnet. Can I prioritize which devices are attempted first? I have a nas with a wired connection which I want to be the primary router, but I also have a backup router configured on a device with more limited bandwidth because its WiFi.

@pupirm8052 Месяц назад

Before all, thank you all Tailscale team for this awesome tool, it's magic. I am trying to connect to my printer through a subnet from my Android phone outside my home network, but my phone can't "see" the printer. Is it a Android app issue, or am I doing something wrong? Thank you.

@user-fo4wd7hy4b День назад

Cool, how do I remove the route? thanks Alex!

@ChilliSinCarne Месяц назад

Can Tailscale be installed directly in my home wifi router? Maybe as a service? or with OpenWRT? I would love to see a video about that!

@ramironunez3608 17 дней назад

Do you have mikrotik and/or ubiquiti on the waiting list?

@turonlumpia Месяц назад

Can you do Derp server next please? My host and clients are behind cgnat. I would like to know how we could solve this issue

@trackview9146 Месяц назад

We want start on boot for the android client

@IOAyman Месяц назад

Thanks Alex. Such a great explanations you're doing. I've got a couple of questions though: 1. Given two environments: A machine XXX running Tailsacle in site S01 on a local network 192.168.1.0/24, and a remote machine YYY acting as a subnet-router running in another site S02 in which the network is also 192.168.1.0/24. The question: Would this work? I guess this would cause a conflict. Knowing that you don't have access to the router configuration on both sites to change the network configuration, how do you suggest setting the subnet-router to access devices in S02 that you can't install Tailscale on? 2. (much simpler question 😅): Is there a Discord server for the Tailscale commnity to chat/exchange on? Thanks in advance.

@Tailscale 27 дней назад

You're looking for our 4via6 subnet routing to solve for overlapping subnet ranges. - Alex tailscale.com/kb/1201/4via6-subnets

@qaim.ali1 Месяц назад

Why tailscale website is not working ? When ever I am trying to visit and download tailscale setup file it is showing "this site can't be reached" ?? Why ?

@naitcalo2141 Месяц назад

Very useful video, I have one question though, I have succesfully enabled 2 subnet routes (debian server both), one local and one remote. The problem is that when both are enabled I cannot reach my local containers with local IPs like 192.168.0.xx. As soon as I disable the local subnet I can reach my containers and my remote network but obviously not the other way around. Any ideas? thanks

@Tailscale Месяц назад

You might need to add a route like this. Though you mention containers so I’m not 100% sure what your layout is. ip rule add to 10.42.0.0/20 priority 2500 lookup main

@naitcalo2141 Месяц назад

@@Tailscale Thank you for your reply, in my local network I have this server running tailscale and also running docker containers, if I enable subnet routes on the remote site I can reach remote network just fine but if I enable subnets on my local server also then I cannot reach my local ips not my local containers with local ips 192.168.0.xx but I still can reach the remote network with their local ip 192.168.178.xx. I think both subnets are conflickting to each other somehow. Thank you

@yagoa 17 дней назад

no MacOS instructions?

@pepeshopping Месяц назад

Wow! You mean this IP code behaves like all other proper IP code!?

@enricoerasco Месяц назад

Hi Alex,can you make a video in German?

@Tailscale Месяц назад

Nein. Mein Deutsch ist schlecht. For now you’ll just have to enjoy an Americanized Alex!

@TheChadXperience909 Месяц назад

Explaining how to set it up and use it doesn't help us understand how it's working. I opened this video hoping to understand exactly what it's actually doing, but what I got was a sales pitch. "Look how easy it is!" Oh, fine... But, "easy" usually isn't secure, and so why should I trust this? How do I know my network remains secure, even from the people at Tailscale? Forget "policy". How do I know that it's protected by enough "technological" barriers to prevent someone with top level access to Tailscale's control servers to grant themself permision to add themselves to my network? Explain THAT to me, and then I'd be sold. And, don't bother telling me that nothing is ever perfectly secure, or that a malicious patch could be pushed. No, thank you, Captain Obvious! You really think I don't already know that?

@Diastolicflame Месяц назад

Its free though

@TheChadXperience909 Месяц назад

@@Diastolicflame That usually just means that YOU are the product, because nothing is ever really free. I wouldn't care if they paid me to use it, if it's going to provide somebody with a backdoor into my network.

@Tailscale 27 дней назад

Hi Chad, We have a comprehensive explanation over on our blog. Hope this helps! tailscale.com/blog/how-tailscale-works - Alex

@TheChadXperience909 27 дней назад

@@Tailscale Uhh... This does not fully explain how Tailscale prevents an unauthorized party from gaining access to the coordination server and adding themself to the network. You describe how you outsource the authentication to third-parties. However, what's to prevent that third-party from, suffering a breach, or themselves resetting my password, and using the new credentials to access Tailscale? Actually, there are probably ways they could simply generate a valid access credential, even without resetting the password in a way completely tranparent to the user. Also, how is the user's database kept secure? Is it encrypted end-to-end with an independant key, with that credential never being shared with either Tailcale, or tied to the third-party authentication? For example, by using an independant key held exclusively client-side? Proton Mail offers an option to use a two-password scheme, with one never leaving the client. I'd like to have assurance that no outside party can either, suffer a breach, or be compelled to provide access to the account, as happened in the Lavabit case. Considering the level of potential exposure, I'd need some assurance that even with unfettered access to the account, an outside party would be unable to aquire anything other than what minimal PII and logs are necessary to provide the service, and the end-to-end encrypted blobs, of course. I'm already aware that we're able to self-host our own instance. However, I'm not asking about that.